Decisions about “Storage and Use of Personal Data in the Context of Health”
The European Court of Human Rights (“Court”) refers to the following two principles found in the European Convention on Human Rights (“Convention”) while making an assessment on storage and use of personal data in the context of health: Right to Respect for Private and Family Life.
Article 8 of the Convention under the title of “Right to Respect for Private and Family Life”, provides that everyone has the right to respect for his private and family life, his home, and his correspondence. The Convention held that there shall be no interference by a public authority with the exercise of this right except such as under the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
In this respect, the protection of personal data is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life, as guaranteed by Article 8 of the Convention and the domestic law must afford appropriate safeguards to prevent any such use of personal data as may be inconsistent with the guarantees of this Article. Therefore, the Court evaluates whether there is a violation of rights within the framework of the above-mentioned principle.
In this article, concerning storage and use of personal data in the context of health, L.L. v. France (no. 7508/02), Chave née Jullien v. France, and Dragan Petrović v. Serbia decisions adjudicated by ECHR will be summarized.
1. L.L. v. France (no. 7508/02)
The applicant particularly complained about the submission to and use by the courts of documents from his medical records, in the context of divorce proceedings, without his consent and without a medical expert having been appointed in that connection.
The Court observed that it was only on a subsidiary basis that the French courts had referred to the impugned medical report in support of their decisions, and it appeared that they could have reached the same conclusion without it. The Court further noted that domestic law did not provide sufficient safeguards as regards the use in this type of proceedings of data concerning the parties’ private lives, thus justifying a fortiori the need for a strict review as to the necessity of such measures. Because of these reasons, in this Decision, the Court held that there had been a violation of Article 8 of the Convention, finding that the interference in the applicant’s private life had not been justified in view of the fundamental importance of protecting personal data.
You may access the Decisionby this link; L.L. v. France (no. 7508/02)
2. Chave née Jullien v. France
This case concerned the storing in a psychiatric hospital record of information relating to the applicant’s compulsory placement, the illegality of which had been recognized by the French courts. The applicant particularly considered that the continued presence in a central record of information about her confinement in a psychiatric institution constituted an interference with her private life and wanted such information to be removed from central records of this type.
The Commission particularly observed that the recording of information concerning mental patients served not just the legitimate interest of ensuring the efficient running of the public hospital service, but also that of protecting the rights of the patients themselves, especially in cases of compulsory placement. In this present case, the Commission noted, inter alia, that the information at issue was protected by appropriate confidentiality rules. In addition, these documents could not be equated with central records and were by no means accessible to the public, but only to exhaustively listed categories of persons from outside the institution. Therefore, the Commission found that the interference suffered by the applicant could not be held to have been disproportionate to the legitimate aim pursued, namely protection of health. Consequently, the Commission declared the application inadmissible as manifestly ill-founded.
You may access the Decision by this link; Chave née Jullien v. France
3. Dragan Petrović v. Serbia
This case concerned a police search of the applicant’s flat and the taking of a saliva sample from him for a DNA analysis during a murder investigation. The applicant complained that the search and taking of the DNA sample had violated his rights protected by the Convention.
The Court, primarily observed that the police search of the applicant’s apartment, finding that the search warrant had been specific enough and had been attended by adequate and effective safeguards against abuse during the search itself. Therefore, the Court held that there had been no violation of Article 8 of the Convention as regards the police search of the applicant’s apartment. In addition to this, the Court held that there had been a violation of Article 8 owing to the taking of a DNA saliva sample from the applicant, finding that the taking of the DNA saliva sample had not been in accordance with the law within the meaning of Article 8. The measure had been carried out under a previous Code of Criminal Procedure, which had only authorized that blood samples could be taken, or other medical procedures carried out. Furthermore, the Court noted that the Code had been updated in 2011 with new safeguards related to DNA mouth swabs, an implicit acknowledgement that they had been lacking previously.
You may access the Decision by this link; Dragan Petrović v. Serbia
Conclusion
As a result, it is seen in the above-mentioned decisions that the Court takes the 8th Article of the Convention as a basis when evaluating the concrete facts regarding storage and use of personal data in the context of health. While making this assessment, the Court has taken into account as to whether the intervention was proportionate and the country’s legislation in the concrete case contains regulations that may violate the rights of individuals. In this regard, according to the Court decisions, the domestic law should notably ensure that such personal data are relevant and not excessive in relation to the purposes for which they are stored; and preserved in a form which permits identification of the data subjects for no longer than is required for the purpose for which those data are stored. It must also afford adequate guarantees that retained personal data were efficiently protected from misuse and abuse.
To see our other articles, you may follow the NSN Bulletin via the link.
Authors: Bilge Derinbay, Hande Ülker Pehlivan
Contact: bilge.derinbay@nsn-law.com